The EU AI Act: What This New Rulebook Means for Your Website

I’ll be honest. When I first read about Regulation 2024/1689, better known as the EU AI Act, my eyes glazed over. Another regulation. Haven’t we only just got our heads around GDPR?

Then I looked at the calendar. The first rules that touch ordinary website owners started applying on 2 August 2026, and a week before that the whole timetable was torn up and rewritten. So if you read something about this last year and filed it under “deal with it later”, later has arrived and the dates you wrote down are wrong.

Here’s what’s happened, in plain English, and then the bit that actually applies to you. Which is smaller than you’d fear.

The thing nobody told you: the rules changed in July

The AI Act passed in 2024 with a staggered timetable. Bans first, then rules for the big underlying AI models, then the heavy obligations for so-called high-risk systems on 2 August 2026.

The problem was that Brussels wrote the deadlines before it wrote the instruction manual. The technical standards weren’t finished. Half the member states hadn’t appointed the authorities meant to police any of it. Businesses were being told to prove compliance against a rulebook that didn’t exist, which is a bit like being asked to sit an exam and then told the syllabus is still at the printers.

So the Commission proposed a fix, the Digital Omnibus on AI. It became Regulation (EU) 2026/1744, published on 24 July 2026 and in force from the 27th. They cut it fine deliberately, because the old deadline was days away.

This matters because nearly everything you’ll find online about AI Act deadlines was written before it happened.

This matters because almost every article you’ll find about AI Act deadlines was written before that happened.

What the Act is actually for

It isn’t a ban on AI and it isn’t an attempt to stop innovation. It’s a risk ladder.

At the top sit practices that are simply not allowed. Social scoring, where people get rated on their behaviour and treated differently as a result, and note that this ban isn’t limited to governments, which plenty of write-ups get wrong. Private companies can’t do it either. Also out: emotion recognition in workplaces and schools, scraping faces off the internet to build recognition databases, and real-time biometric identification in public by police, with narrow exceptions.

Below that are high-risk systems. Allowed, but heavily controlled. AI that screens job applicants, marks exams, decides who gets credit, or runs part of a hospital. Conformity assessments, documentation, logging, human oversight, demonstrable accuracy. That’s a genuine project, and it’s why the deadline moved.

Then limited-risk systems, which just have to be honest about themselves. That’s the tier most websites live in.

And at the bottom, minimal risk, where almost nothing is required. Spam filters, basic recommendation engines, autocorrect. The vast majority of what your site does.

The definition of an AI system is narrower than the headlines suggest, incidentally. It has to operate with some degree of autonomy and may adapt after deployment. A spreadsheet formula that does exactly what you told it every single time isn’t AI just because it’s clever.

The bit that’s just started: transparency

Chatbots first. If you’ve got one, users need to know they’re talking to software. Not buried in a privacy policy. Visible, at the point of contact. If it’s blindingly obvious from context you get some latitude, but I wouldn’t lean on it.

Now pictures, audio and video, where the advice online goes lazy. The rule is not “label all AI images”, it’s about deepfakes, and the Act means something specific by that word.

Three things have to be true at the same time. Miss any one of them and the labelling duty doesn’t apply to you.

The obligation nobody mentions

Article 4. AI literacy.

It’s applied since February 2025, it covers everyone providing or using AI rather than just the high-risk crowd, and I’ve almost never seen it discussed. You have to take measures to give your staff and other relevant people a reasonable working understanding of the AI they’re using. The Omnibus softened the wording so you’re not guaranteeing any particular standard for any particular person, but the duty is still there.

For a one-person operation this is not onerous. It means knowing what your tools do, what they get wrong, and when not to trust them. For anyone with staff, it means an actual conversation and probably a note that you had it. That’s it. But it exists, and it touches practically every business in the EU.

So what does your website actually have to do?

Take stock first. Write down every AI system your site touches. The chatbot. The recommendation widget. The writing assistant. The spam filter. The bits your website builder and email platform bundle in without telling you, which is more of them than you’d think.

For each one, ask what it does to people. Does it decide something about them, or does it just tidy something up? Sorting spam is tidying. Screening job applicants is deciding. That distinction is more or less the whole Act in a sentence.

Then the easy wins. Label your chatbot today, because it’s one line of text.

Label photoreal synthetic media going forward, and leave your archive alone.

If you’re sifting job applications through your careers page, you’re in high-risk territory and you’ve got until December 2027, and you’ll need it.

If you’re relying on third-party tools, and you are, most of the burden sits with whoever built them. Not all of it. You have your own duties as a deployer, and “my supplier said it was fine” isn’t a defence anyone has ever won with. Ask your vendors what they’re doing about the AI Act and see whether the answer sounds like a plan or a press release.

On fines, size the risk properly. The famous 35 million euros or seven per cent of global turnover applies to the outright banned practices. Transparency breaches and most other failures top out at 15 million or three per cent, and misleading a regulator at 7.5 million or one per cent. Those are ceilings for the worst offenders among the largest companies, and regulators are specifically told to be proportionate with small businesses. Nobody is coming for your unlabelled chatbot with a seven-figure penalty. But proportionate is not the same word as ignored.

Where I’ve landed on all this

The AI Act isn’t the monster it was made out to be, and the July rewrite is a quiet admission that the original timetable was written by people who’d never had to comply with anything.

For most website owners the practical job is small. Label your chatbot. Label photoreal synthetic media from here on. Know what tools you’re using. Make sure whoever works with you understands the AI they’re touching. Keep an eye on your suppliers. That’s a morning’s work, not a compliance department.

If you’re doing something that genuinely affects people’s lives, screening candidates, scoring creditworthiness, marking exams, then yes, real work is coming and you’ve got until December 2027. Start now anyway. Sixteen months disappears faster than you think, and the standards you’ll need are still being written.

What I keep coming back to is that none of this is really about AI. It’s about whether the people affected by an automated decision get to know it was made, and get a way to argue with it. Strip out the article numbers and that’s what’s left. Hard to object to, even when the paperwork is annoying.

Have a look at your own site this week. Find the AI, label the bits that need it, put December 2027 in the diary. Then go and have a cup of tea, because that really is most of it.

Walter